neconyd | 04bf2f640affb7d4a6c6f2fd8644471301a9b0f0f4d0b6407b55f5784db6bb06

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 14:32

Target

0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe
Size

89KB
MD5

0ea0473e79c565198836f8c68397e1d0
SHA1

04a460382a2ca31bc366932cc17f66fdcc9249bc
SHA256

04bf2f640affb7d4a6c6f2fd8644471301a9b0f0f4d0b6407b55f5784db6bb06
SHA512

5ce411f784e9b52fd1a743bb6449a5ba6f8fd1404fe0a23fdf48dd844a26f050898a48e64faa7c20bcd3378760bf69dc344868224fd499b0f79299a11be68bfb
SSDEEP

768:LMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:LbIvYvZEyFKF6N4yS+AQmZTl/5

Score

10^/10

neconyd trojan

Family

neconyd

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Executes dropped EXE 3 IoCs

Loads dropped DLL 6 IoCs

pid	Process
1644	0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe
1644	0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe
1672	omsecor.exe
1672	omsecor.exe
2104	omsecor.exe
2104	omsecor.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1672	1644	0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 1672	1644	0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 1672	1644	0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe	28
PID 1644 wrote to memory of 1672	1644	0ea0473e79c565198836f8c68397e1d0_NeikiAnalytics.exe	28
PID 1672 wrote to memory of 2104	1672	omsecor.exe	32
PID 1672 wrote to memory of 2104	1672	omsecor.exe	32
PID 1672 wrote to memory of 2104	1672	omsecor.exe	32
PID 1672 wrote to memory of 2104	1672	omsecor.exe	32
PID 2104 wrote to memory of 1600	2104	omsecor.exe	33
PID 2104 wrote to memory of 1600	2104	omsecor.exe	33
PID 2104 wrote to memory of 1600	2104	omsecor.exe	33
PID 2104 wrote to memory of 1600	2104	omsecor.exe	33

C:\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
f1327f1f7b510583e3a8586aded218ca

SHA1
6400a002af63ddf9aa8514847429a19f47bda0bd

SHA256
ad4bed6f81d60f9bbbb4d391f294c06f92947a89bf343f4b8fa62f7ef9266016

SHA512
6759c348adb21d21fefe2d2a3da8a34b2840bebda0394022929ded7f0c9bd079fc65e179b8fcd21ddebd1684cd868a359c1421cba2c0ec4fc3a0abcfab82f4dd

Download Submit
\Users\Admin\AppData\Roaming\omsecor.exe

Filesize
89KB

MD5
44d0a67e586e3be20dd416b4f3883af7

SHA1
398e6dca3c13bb34784d176e99706d25d6fcb5b7

SHA256
297d479bb5bb63d586b07053d8721ec9fc93e7151370099c3fc3331a76e13eed

SHA512
450a52e4a152fb9eaee4a5d6f50e405197fb3dce0b914e324eb514476c6b303c60e821c6aa2b3fd70e0904ec3fa46c11a616cf6db4dfde662999e95fbdf05b04

Download Submit
\Windows\SysWOW64\omsecor.exe

Filesize
89KB

MD5
33eae5b081078ad3b64bb9e19a895890

SHA1
912d8b905490c085249c6cef871e55ef8d4e5b49

SHA256
341ee099af41cb6b52deb7eaf45cbc8cb757c3dca6f915478cd7429f2b0923dd

SHA512
3832cde47d9e8c6e21f5c7214d6549acc8e6910446049f9a2f13878a60480f3005c983160dceaa464fb3e63e5a5a601b8c4dd8f92f4a25bbbbf0ca233cf86684

Download Submit